Analysing  the  Network  of  an  ISIS  Twitter  Account 

This  blog  post  was  first  posted  to  the  International  Centre  for 
Security  Analysis  blog  on  the  14th  November  2014. 

It  is  well  documented  that  the  Islamic  State  of  Iraq  and  al-Sham  (ISIS)  has  an  active  and 
well-developed  media  presence,  especially  on  social  networks.  Recently,  Robert 
Hannigan,  director  of  the  Government  Communications  Headquarters  (GCHQ),  wrote 
in  the  Financial  Times  that  social  networks  have  become  the  'command-and-control 
networks  of  choice  for  terrorists  and  criminals". 

We  tested  the  conclusion  reached  in  other  studies  that  far  from  being  a tightly  controlled 
mouthpiece  for  ISIS  propaganda,  Twitter's  structure  has  resulted  in  a fragmented 
network  of  fighters,  sympathisers  and  disseminators  competing  for  attention.  We  used 
open-source  tools  and  techniques  to  visualise  and  analyse  an  ISIS  Twitter  network 
centred  around  a search  of  mentions  and  replies  for  one  particular 
account,  lSTimes2,  on  the  1 1th  November  2014.* 

NodeXL  was  used  to  scrape  and  structure  the  information  from  Twitter  with  the 
resulting  file  exported  into  Tephi,  an  open-source  network  visualisation  platform.  This 
research  worked  within  certain  constraints.  Notably,  Twitter  imposes  "rate  limiting" 
when  accessing  its  application  programming  interface  (API)  and  so  a Twitter  network 
based  on  1,000  mentions  and  replies  (but  excluding  follows)  was  extracted  to  minimise 
its  impact. 

Screenshot  1 shows  the  extracted  network  with  distinct  communities  forming  in  clusters 
around  important  nodes.  Force  Atlas  was  selected  as  the  layout  with  average  path  length 
and  betweeness  centrality  used  to  refine  the  network.  Communities  were  identified  using 
the  modularity  function  which  resulted  in  a network  comprised  of  three  main 
communities. 

The  community  coloured  purple  is  formed  around  the  @ISTimes2  account  with  the 
network  of  users  forming  a spiral  around  this  central  node.  The  orange  community  is 


centred  on  another  important  ISIS  account,  1SL10.  . Notably,  it  has  relatively  few  links 
to  the  ISTimes2  network  with  just  six  accounts  visibly  acting  as  a bridge  between  the 
two  communities.  Finally,  the  third  community,  coloured  blue,  is  more  diffuse  with  a 
multiple  important  nodes  around  which  the  network  has  formed.  These  critical  nodes 
include  influential  and  emerging  ISIS  disseminators  such 
as  @ShamiWitness,  @NusantarWitness  and  @ShamBreaking3. 


Screenshot  1 : The  complete  network  with  three  clearly  identified  communities 


Screenshot  2 shows  the  community  centred  on  the  @ISTimes2  account  with  the 
community  of  users  spiralling  around  this  node.  The  majority  of  these  users  are  ISIS 
supporters  but  this  community  also  includes  a number  of  journalists  and  opponents  of 
ISIS  engaging  with  other  users. 
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Screenshot  2:  The  community  centred  on  the  @ISTimes2  account 


Screenshot  3 shows  the  @ISL103  account  and  the  largely  distinct  community  that  has 
formed  around  it. 
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Screenshot  3:  The  community  formed  around  the  @ISL103  account 


Screenshot  4 shows  the  third  identified  community.  Unlike  the  other  two  it  is  more 
diffuse  and  based  around  multiple  influential  disseminators  of  ISIS  propaganda  and 
messages.  These  accounts  have  multiple  links  to  the  members  of  the  @ISTimes2 
community  reflecting  greater  interaction  through  Twitter  mentions  and  replies. 
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Screenshot  4:  The  diffuse  third  community  centred  on  important  ISIS  disseminators 


All  three  communities  were  composed  of  very  similar  members  often  including  a 
mixture  of  ISIS  fighters  (and  those  claiming  to  be  fighters),  sympathisers  and 
disseminators.  The  majority  of  the  accounts  identified  in  this  network  analysis  were 
therefore  broadly  supportive  of  the  message  and  actions  of  ISIS.  However,  a minority 
of  nodes  were  Twitter  users  opposed  to  the  group  and  their  ideology.  For 
example  fShameSheej , a user  who  engages  with  ISIS  supporters  and  attacks  their 
beliefs  and  claims. 


This  network  visualisation  of  the  communities  interacting  with  @ISTimes2, 
confirms  findings  from  prior  studies.  It  demonstrates  that  ISIS  lacks  formal  centralised 
control  over  the  communications  activities  of  its  fighters  and  supporters.  Instead 
it  exerts  indirect  control  through  spreading  propaganda  messages,  often  in  video  or 
image  form  that  are  then  shared  by  its  supporters  and  disseminators  to  a wider  audience. 
Therefore,  although  Robert  Hannigan  is  right  to  identify  social  networks  as  crucial 
elements  in  the  command  and  control  structure  of  ISIS;  the  group's  leadership  lack  the 
ability  to  directly  control  the  communication  of  their  ideology. 

This  analysis  also  shows  that  the  ability  of  ISIS  to  communicate  beyond  its  narrow 
audience  of  supporters  is  fundamentally  reliant  on  disseminators  such 
as  @ShamiWitness.  As  our  colleagues  at  the  International  Centre  for  the  Study  of 
Radicalisation  and  Political  Violence  (ICSR)  noted  in  #Greenbirds  a significant 
proportion  of  foreign  fighters  consume  information  regarding  the  conflicts  in  Iraq  and 
Syria  from  disseminators  rather  than  exclusively  through  official  ISIS  channels. 

Finally,  the  ever-shifting  landscape  of  ISIS  twitter  accounts  presents  a number  of 
challenges  to  analysing  their  networks  of  communication.  Twitter  routinely  suspends 
and  deletes  the  accounts  of  ISIS  users  for  breaching  the  terms  and  conditions  of  the  site 
while  ISIS  fighters  and  sympathisers  delete  their  accounts  in  periodic  bouts  of  paranoia 
and  suspicion.  Network  analysis  can  therefore  only  provide  a static  glimpse  of  how  these 
users  communicate  between  themselves  and  to  the  outside  world.  Nevertheless,  it 
provides  valuable  insights  into  the  diffuse  nature  of  ISIS's  Twitter  presence  and  the 
importance  of  disseminating  nodes  around  which  communities  form. 

*Note:  many  of  the  Twitter  accounts  referred  to  in  this  piece  post  graphic  text,  images 
and  videos. 


